Skip to content
BattleTest

BattleTest: automated PR review and live security testing

One agent, one evidence standard, two scopes. PR security review is free and open to anyone: it reviews every pull request and posts what it finds on the diff. Live application testing is the same agent at full scope against a running system, shipped only as a BattleTest Enterprise deployment inside a client’s own network.

PR Security Review

Every pull request gets a full security analysis (CVE detection, secret scanning, injection analysis, config hardening checks) posted as a GitHub comment within minutes.

BattleTest Enterprise

The agent crawls and probes a running application, discovering endpoints, testing for active vulnerabilities, and reporting what it confirmed and what it could not reach. Runs as a dedicated per-client deployment.

What you get on every pull request

Section titled “What you get on every pull request”

When a developer opens a PR, BattleTest runs automatically and posts a review as a comment on the diff within 2–4 minutes:

No configuration. No CI pipeline changes. Nothing to remember to trigger.

The two products share one finding record, so a vulnerability caught in a PR and later confirmed in a live scan is linked. A resolved issue that resurfaces is flagged as a regression. For the design behind this, read About BattleTest.

Where to start

Section titled “Where to start”
Get your first PR review

Connect a repo and see a real security review in under 5 minutes.

How live testing works

What a run does, what it reports, and how a dedicated deployment is set up.

How the docs are organised

Section titled “How the docs are organised”

The documentation has four sections:

  • Tutorials: step-by-step guides through a complete task. Start here if you’re new.
  • Concepts: how BattleTest works, why it’s designed this way, and how to interpret what it produces.
  • How-to guides: task-focused instructions for specific goals: configuring settings, managing findings, exporting reports. Assumes you know your way around the product.
  • Reference: technical specifications: finding fields, scan report structure, GitHub App permissions, limits, and notification events.